MyCreate Privacy Policy

1. Introduction

This Privacy Policy explains how MyCreate (a trading name of Wanderlust Brands Ltd, registered in England and Wales) collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

MyCreate is the data controller for the personal data we process. This means we are responsible for deciding how and why your personal data is processed.

This policy applies to two categories of individuals:

• Creators — individuals who register on MyCreate to create and operate beauty brands through the platform
• Customers — individuals who purchase products from MyCreate storefronts

If you are a creator, the relevant sections are Parts A and C. If you are a customer, the relevant sections are Parts B and C.

Part A: Creator Data

2. Data We Collect From Creators

We collect the following categories of personal data when you register and use MyCreate:

3. How We Use Creator Data

We use your personal data for the following purposes:

• Providing the MyCreate platform service (account data, brand data, transaction data) — Legal basis: Performance of a contract (UK GDPR Art. 6(1)(b))
• Processing creator earnings and payouts (bank details, transaction data) — Legal basis: Performance of a contract (UK GDPR Art. 6(1)(b))
• Regulatory compliance — UK Responsible Person obligations, CPSA, SCPN (brand data, product data, transaction data) — Legal basis: Compliance with a legal obligation (UK GDPR Art. 6(1)(c))
• Fraud prevention and detection (transaction data, technical data, account data) — Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f))
• Platform security and abuse prevention (technical data, account data) — Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f))
• Platform improvement and product development (brand data aggregated/anonymised, usage data) — Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f))
• Communicating with you about your account, updates, and changes to terms (email address) — Legal basis: Performance of a contract (UK GDPR Art. 6(1)(b))
• Community features — forums, surveys (forum posts, survey responses) — Legal basis: Legitimate interests (UK GDPR Art. 6(1)(f))
• Marketing communications — newsletter, product updates (email address) — Legal basis: Consent (UK GDPR Art. 6(1)(a)) — you can opt out at any time

4. Creator Data We Do Not Collect

• We do not collect national insurance numbers
• We do not collect passport or driving licence copies
• We do not collect credit or debit card numbers (payments are processed by our payment processor, Stripe — see Section 7)
• We do not collect biometric data
• We do not collect data about your health, religion, ethnicity, or sexual orientation

Part B: Customer Data

5. Data We Collect From Customers

When a customer purchases products from a MyCreate storefront, we collect:

6. How We Use Customer Data

• Processing and fulfilling orders (order data, shipping address) — Performance of a contract (UK GDPR Art. 6(1)(b))
• Order confirmations and shipping notifications (email address) — Performance of a contract (UK GDPR Art. 6(1)(b))
• Processing returns and refunds (order data, email address) — Performance of a contract (UK GDPR Art. 6(1)(b))
• Regulatory compliance — cosmetics regulations, product safety (order data) — Compliance with a legal obligation (UK GDPR Art. 6(1)(c))
• Fraud prevention (order data, technical data) — Legitimate interests (UK GDPR Art. 6(1)(f))
• Marketing communications — newsletter (email address) — Consent (UK GDPR Art. 6(1)(a)) — you can opt out at any time

Part C: Shared Provisions

7. Data Sharing

We do not sell your personal data. We share personal data with the following categories of recipients, only where necessary:

8. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). Where data is processed outside the UK/EEA (for example, by cloud infrastructure providers with servers in other regions), we ensure that appropriate safeguards are in place, including: UK International Data Transfer Agreements (IDTA); Standard Contractual Clauses (SCCs) as adopted by the UK government; certification schemes such as the EU-US Data Privacy Framework (where applicable). You can request a copy of the safeguards we have in place for international transfers by contacting privacy@mycreate.zone.

9. Data Retention

We retain personal data only for as long as necessary:

• Creator account data: duration of account + 6 years after closure (for tax/financial records)
• Bank details: duration of account + 6 years after closure (for financial audit)
• Transaction data: 6 years (tax and regulatory requirement)
• Customer order data: 6 years from order date (tax and regulatory requirement)
• Brand data: duration of account. On exit, transferred to acquiring party or deleted per creator request (subject to legal retention)
• Forum posts and survey responses: duration of account + 2 years
• Marketing consent records: duration of consent + 2 years after withdrawal
• Technical/log data (IP addresses, login records): 12 months
• AI-generated brand assets: duration of account. Deleted on account closure unless transferred as part of brand exit.
• Parental consent data (for 16–17 year olds): parental contact details deleted 12 months after creator turns 18

When the retention period expires, we securely delete or anonymise the data.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption — personal data is encrypted in transit (TLS 1.2+) and at rest
• Access controls — role-based access; only authorised personnel can access personal data, and only the minimum necessary for their role
• Bank details — stored separately from other account data with additional encryption; accessible only to authorised finance personnel
• Regular security reviews — we periodically assess and update our security measures
• Staff training — all MyCreate personnel with data access receive data protection training
• Incident response — we have procedures in place to detect, investigate, and report data breaches in accordance with UK GDPR requirements (reporting to the ICO within 72 hours where required)

11. Your Data Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): you can request a copy of the personal data we hold about you. We will provide this within one month, free of charge.
• Right to Rectification (Art. 16): you can ask us to correct any inaccurate or incomplete personal data. You can update most account information directly through your MyCreate dashboard.
• Right to Erasure (Art. 17): you can ask us to delete your personal data. This right is subject to legal retention requirements — for example, we must retain financial records for 6 years for tax purposes.
• Right to Data Portability (Art. 20): you can request a copy of your personal data in a structured, machine-readable format, to transfer to another service provider.
• Right to Object (Art. 21): you can object to the processing of your personal data for direct marketing, or where we are relying on legitimate interests.
• Right to Restrict Processing (Art. 18): you can ask us to restrict the processing of your personal data in certain circumstances.
• Right to Withdraw Consent (Art. 7): where we process your data based on consent (e.g., marketing emails), you can withdraw consent at any time.

To exercise any of these rights, contact us at privacy@mycreate.zone. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Cookies

MyCreate uses cookies and similar technologies to operate the platform.

Essential Cookies (no consent required):

• Session management (keeping you logged in)
• Shopping cart functionality
• Security and fraud prevention
• Load balancing

Analytics Cookies (consent required):

• Understanding how visitors use the platform (pages visited, time spent, bounce rate)
• Improving platform performance and user experience

Marketing Cookies (consent required):

• Newsletter sign-up tracking
• Retargeting (if implemented)

When you first visit MyCreate, you will see a cookie banner allowing you to accept or reject non-essential cookies. You can change your cookie preferences at any time through your browser settings or via the cookie preference link in the footer. We do not use cookies to track you across other websites for advertising purposes.

13. Automated Decision-Making and AI

MyCreate uses artificial intelligence to generate brand assets (logos, colour palettes, typography, mockups) and to perform automated trademark checks. These tools do not make decisions that have legal or significant effects on you — all AI-generated content is reviewed and accepted or rejected by you before it is used. We do not use automated decision-making for credit checks, risk scoring, or any decision that would significantly affect you without human review.

14. Children's Data

MyCreate is not intended for use by individuals under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a person under 16, please contact privacy@mycreate.zone and we will delete it immediately.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. Material changes will be communicated by email with a minimum of 30 days' notice. The current version and date will always be displayed at the top of this document.

16. Data Controller Details

If you have a complaint about how we handle your personal data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113 | Website: ico.org.uk